Nextendweb Smart Slider 3

• CVE-2026-14876 Medium 6.4 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block 0.2%
• CVE-2026-15798 Medium 6.4 Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute 0.4%
• CVE-2026-12385 Medium 4.3 Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter 0.4%
• CVE-2026-9197 Medium 4.9 Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export 0.6%
• CVE-2026-4065 Medium 5.4 Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation 0.4%
• CVE-2026-3098 Medium 6.5 Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll 0.5%
• CVE-2025-6348 Medium 4.9 Smart Slider 3 <= 3.5.1.28 - Authenticated (Administrator+) SQL Injection via `sliderid` Parameter 0.4%
• CVE-2024-3027 Medium 6.4 Smart Slider 3 <= 3.5.1.22 - Missing Authorization to Limited File Upload 0.3%